diff --git a/bbs/poll_etc_update.php b/bbs/poll_etc_update.php
index 772826872..189c7d362 100644
--- a/bbs/poll_etc_update.php
+++ b/bbs/poll_etc_update.php
@@ -5,8 +5,8 @@ include_once(G5_LIB_PATH.'/mailer.lib.php');
 if ($w == '')
 {
     $po_id   = isset($_POST['po_id']) ? (int) $_POST['po_id'] : '';
-    $pc_name = isset($_POST['pc_name']) ? clean_xss_tags($_POST['pc_name'], 1, 1) : '';
-    $pc_idea = isset($_POST['pc_idea']) ? clean_xss_tags($_POST['pc_idea'], 1, 1) : '';
+    $pc_name = isset($_POST['pc_name']) ? addslashes(clean_xss_tags(stripslashes($_POST['pc_name']), 1, 1)) : '';
+    $pc_idea = isset($_POST['pc_idea']) ? addslashes(clean_xss_tags(stripslashes($_POST['pc_idea']), 1, 1)) : '';
 
     $po = sql_fetch(" select * from {$g5['poll_table']} where po_id = '{$po_id}' ");
     if (!$po['po_id'])
diff --git a/bbs/write_comment_update.php b/bbs/write_comment_update.php
index ed1984251..c7537f430 100644
--- a/bbs/write_comment_update.php
+++ b/bbs/write_comment_update.php
@@ -16,7 +16,8 @@ if (substr_count($wr_content, "&#") > 50) {
 }
 
 $w = isset($_POST['w']) ? clean_xss_tags($_POST['w']) : '';
-$wr_name  = isset($_POST['wr_name']) ? clean_xss_tags(trim($_POST['wr_name'])) : '';
+$wr_name  = isset($_POST['wr_name']) ? addslashes(clean_xss_tags(stripslashes(trim($_POST['wr_name'])))) : '';
+$wr_name  = preg_replace("#[\\\]+$#", "", $wr_name);
 $wr_secret = isset($_POST['wr_secret']) ? clean_xss_tags($_POST['wr_secret']) : '';
 $wr_email = $wr_subject = '';
 $reply_array = array();
@@ -33,7 +34,7 @@ $wr_9 = isset($_POST['wr_9']) ? $_POST['wr_9'] : '';
 $wr_10 = isset($_POST['wr_10']) ? $_POST['wr_10'] : '';
 $wr_facebook_user = isset($_POST['wr_facebook_user']) ? clean_xss_tags($_POST['wr_facebook_user'], 1, 1) : '';
 $wr_twitter_user = isset($_POST['wr_twitter_user']) ? clean_xss_tags($_POST['wr_twitter_user'], 1, 1) : '';
-$wr_homepage = isset($_POST['wr_homepage']) ? clean_xss_tags($_POST['wr_homepage'], 1, 1) : '';
+$wr_homepage = isset($_POST['wr_homepage']) ? addslashes(clean_xss_tags(stripslashes($_POST['wr_homepage']), 1, 1)) : '';
 
 if (!empty($_POST['wr_email']))
     $wr_email = get_email_address(trim($_POST['wr_email']));
diff --git a/shop/itemqaformupdate.php b/shop/itemqaformupdate.php
index 0d1df9c4e..6061f3f55 100644
--- a/shop/itemqaformupdate.php
+++ b/shop/itemqaformupdate.php
@@ -15,8 +15,8 @@ $hash = isset($_REQUEST['hash']) ? trim($_REQUEST['hash']) : '';
 $get_editor_img_mode = $config['cf_editor'] ? false : true;
 
 $iq_secret = isset($_POST['iq_secret']) ? (int) $_POST['iq_secret'] : 0;
-$iq_email = isset($_POST['iq_email']) ? clean_xss_tags($_POST['iq_email'], 1, 1) : '';
-$iq_hp = isset($_POST['iq_hp']) ? clean_xss_tags($_POST['iq_hp'], 1, 1) : '';
+$iq_email = isset($_POST['iq_email']) ? addslashes(clean_xss_tags(stripslashes($_POST['iq_email']), 1, 1)) : '';
+$iq_hp = isset($_POST['iq_hp']) ? addslashes(clean_xss_tags(stripslashes($_POST['iq_hp']), 1, 1)) : '';
 $is_mobile_shop = isset($_REQUEST['is_mobile_shop']) ? (int) $_REQUEST['is_mobile_shop'] : 0;
 
 if ($w == "" || $w == "u") {
diff --git a/shop/orderaddressupdate.php b/shop/orderaddressupdate.php
index 403d0d2bd..0138ba4ce 100644
--- a/shop/orderaddressupdate.php
+++ b/shop/orderaddressupdate.php
@@ -17,7 +17,7 @@ if ($is_member && $count) {
         $k = isset($_POST['chk'][$i]) ? (int) $_POST['chk'][$i] : 0;
         $ad_id = isset($_POST['ad_id'][$k]) ? (int) $_POST['ad_id'][$k] : 0;
 
-        $ad_subject = isset($_POST['ad_subject'][$k]) ? clean_xss_tags($_POST['ad_subject'][$k]) : '';
+        $ad_subject = isset($_POST['ad_subject'][$k]) ? addslashes(clean_xss_tags(stripslashes($_POST['ad_subject'][$k]))) : '';
 
         $sql = " update {$g5['g5_shop_order_address_table']}
                     set ad_subject = '".sql_real_escape_string($ad_subject)."' ";